Reputation
27,243
Next tag badge:
429/400 score
74/80 answers
Badges
2 41 115
Impact
~432k people reached

Jul
24
comment Collision or second preimage for the ChaCha core?
Nitpick: the final addition in the core makes it not easily invertible. We know how to make public, easily computable functions over a 512-bit domain that are demonstrably bijective, but quite computationally hard to invert for arbitrary output (admittedly, building such function using only ARX operations requires a lot of these).
Jul
24
comment Collision or second preimage for the ChaCha core?
Summarizing the discussion: the theorem prover proved that 2 rounds of ChaCha can't collide; this is not directly related to the ChaCha core with 2 rounds colliding. $\;$ It did not answer on if the ChaCha core with 10x2 rounds collides. In fact, if an automated tool could prove or disprove that the ChaCha core with only 2 rounds has collisions, that would be even more an achievement than proving that for the Salsa20 core. $\;$ There are strong heuristic arguments that there are collisions for the ChaCha core using enough rounds for security, we just do not know any (for now).
Jul
24
revised Collision or second preimage for the ChaCha core?
Merge the two clarifications
Jul
24
revised Collision or second preimage for the ChaCha core?
clarification added
Jul
23
revised Collision or second preimage for the ChaCha core?
hopefully clarify the reference code
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
@dannycrane: Yes, in $2/{\log_e n}$ the letter $e$ is the base of natural logarithm, not the public exponent. $\;$ No, in $(1 - 2/{\log_e n}) ^ {\log_2 n - 1} \approx 0.044$, exponentiation is meant; think of $\log_2 n - 1$ as a number of trials, each flipping a bit with odds $1-2/{\log_e n}$ of not reaching a prime.
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
Nice. Flipping a single bit of $e$ to make it $1$, if $e$ is suitable (most $e$ used in practice are), and that's accepted by Alice (which would not be unseen), is another way, involving less work.
Jul
17
comment How many bits to flip in an RSA public key to do signature forgery?
Do you mean: Eve is restricted to invent (e', n') that differ from (e, n) in a small number of bits ? If yes, what is the convention used to map (e, n) to a bitstring ? In particular, would it prevent changing the customary e=65537 to e=1 by flipping the high-order bit, or would that be otherwise rejected by Alice ?
Jul
15
revised Why should the primes used in RSA be distinct?
Mention FIPS 186's prescription
Jul
11
revised Why should the primes used in RSA be distinct?
Remove link to vanished answer
Jul
11
comment Why should the primes used in RSA be distinct?
@rt_mn: in RSA with distinct primes $p$ and $q$, $d\equiv e^{-1}\pmod{(p-1)\cdot(q-1)}$ is a sufficient, but not necessary condition for $d$ being a valid private exponent.
Jul
11
revised Why should the primes used in RSA be distinct?
Add Ricky Demer's reason
Jul
11
answered Why should the primes used in RSA be distinct?
Jul
10
comment How far is public-key crypto involved in “banking world”?
As to your first bullet: yes, see EMV 4.3
Jul
8
comment RSA algorithm assignment
Hints: a) consider what happens when $e$ is small; say 3, 5, or 17, which are reasonable choices when proper padding is used. $\;$ b) regardless of $e$, consider odds that $K$ can be written as the product of two integers neither exceeding, say, $2^{40}$.
Jul
8
revised RSA algorithm assignment
improve appearance
Jul
7
comment RSA with $\lambda(n)$ or $\varphi(n)$
@tylo: very right. My mistake. I wish I could edit (rather than delete) wrong comments.
Jun
29
revised How to select parameters based on some condition
polish, fix ob1
Jun
29
revised How to select parameters based on some condition
polish
Jun
29
answered How to select parameters based on some condition